Capital One data breach 2023: what happened and what to do

In early 2023, a company that collects debts for banks was hacked, and some Capital One customer information was in the files. The company is NCB Management Services, a collections firm that works with financial institutions. This was not a breach of Capital One's own systems.

What happened

According to Capital One's notice to the Maine Attorney General, an outside attacker got into NCB's systems between February 1 and 4, 2023. Capital One reported that 16,779 people in total were affected, 222 of them in Maine. Capital One also notified regulators in other states, including Washington, in late May 2023, which is when most customers learned of it.

NCB's own letters covered a much larger group, because other banks and lenders also used the firm. Capital One's numbers refer only to its customers. NCB told the people it notified that it had obtained assurances the unauthorized party no longer has access to its data.

How a collections firm ends up with your data

Banks and lenders hand overdue accounts to collection agencies, and the agency receives the account details it needs to contact people and match payments. That is why a customer who never heard of NCB can be in its files. Other financial companies, including Bank of America, Exeter Finance and Pathward, were also reported as affected through NCB, each with its own count and its own notice letters.

The timeline in the filings is worth knowing. The attack ran February 1 to 4, 2023. The Maine filing gives April 26, 2023 as the discovery date, and notices went out in late May. If your letter arrived that month, the delay was in the notification, not in your mail.

What was exposed

Reporting on the notice says the files included home addresses, Social Security numbers, account numbers and account status information. The sources don't say passwords or card security codes were involved.

A Social Security number plus an address and account details is the combination used for identity theft. With it, a criminal can try to open credit in your name or pass a "verification" check by phone. Account numbers also make phishing calls and texts that claim to be from your bank more convincing.

What Capital One and NCB did

NCB investigated with outside security help and notified the banks that sent it accounts. Capital One sent notice letters to affected customers and filed with state regulators. If you got a letter, it will say what applied to you, and it is the best source on your own case.

What this means for you

A breach at a vendor doesn't change your Capital One login, so there is nothing to reset on that side. The risk is the Social Security number, which doesn't expire. Credit freezes, which the FTC describes as free and lasting until you lift them, are the usual answer because they block lenders from opening new credit in your name. If a lender needs to check your credit later, you lift the freeze for that application.

What to do

If a Capital One or NCB letter reached you, treat your Social Security number as exposed. A credit freeze is the standard step, and it's free. Check your credit reports for accounts you don't recognize, and read your bank statements for charges you didn't make.

Official filings

• Washington Attorney General , filed 26 May 2023 : 605 people

Timeline

1. 1 Feb 2023

   The breach happened

2. 26 May 2023

   The company made it public

3. 26 May 2023

   Reported to the Washington Attorney General